diff --git a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsContentAccess.ql b/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsContentAccess.ql deleted file mode 100644 index 1657f417754..00000000000 --- a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsContentAccess.ql +++ /dev/null @@ -1,21 +0,0 @@ -/** - * @name Android WebSettings content access - * @description Access to content providers in a WebView can enable JavaScript to access protected information. - * @kind problem - * @id java/android/websettings-content-access - * @problem.severity warning - * @security-severity 6.5 - * @precision medium - * @tags security - * external/cwe/cwe-200 - */ - -import java -import semmle.code.java.frameworks.android.WebView - -from MethodAccess ma -where - ma.getMethod() instanceof AllowContentAccessMethod and - ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true -select ma, - "Sensitive information may be exposed via a malicious link due to access of content:// links being permitted." diff --git a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsContentAccess.qhelp b/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.qhelp similarity index 100% rename from java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsContentAccess.qhelp rename to java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.qhelp diff --git a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.ql b/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.ql index 509b062c595..7ccf23cc3ae 100644 --- a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.ql +++ b/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.ql @@ -94,7 +94,19 @@ class WebViewDisallowContentAccessConfiguration extends TaintTracking::Configura } } -from WebViewSource source -where not any(WebViewDisallowContentAccessConfiguration cfg).hasFlow(source, _) -select source, +from Expr e +where + // explicit: setAllowContentAccess(true) + exists(MethodAccess ma | + ma = e and + ma.getMethod() instanceof AllowContentAccessMethod and + ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true + ) + or + // implicit: no setAllowContentAccess(false) + exists(WebViewSource source | + source.asExpr() = e and + not any(WebViewDisallowContentAccessConfiguration cfg).hasFlow(source, _) + ) +select e, "Sensitive information may be exposed via a malicious link due to access of content:// links being permitted." diff --git a/java/ql/src/change-notes/2022-12-21-android-allowcontentaccess-query.md b/java/ql/src/change-notes/2022-12-21-android-allowcontentaccess-query.md index 008da665b57..854da87eb54 100644 --- a/java/ql/src/change-notes/2022-12-21-android-allowcontentaccess-query.md +++ b/java/ql/src/change-notes/2022-12-21-android-allowcontentaccess-query.md @@ -1,4 +1,4 @@ --- category: newQuery --- -* Added a new query `java/android/websettings-content-access` to detect Android WebViews which do not disable access to `content://` urls. +* Added a new query `java/android/websettings-permit-contentacces` to detect Android WebViews which do not disable access to `content://` urls. diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccess.expected b/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccess.expected index dc904ca6cd7..317f847279f 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccess.expected +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccess.expected @@ -1,5 +1,10 @@ | WebViewContentAccess.java:15:9:15:57 | setAllowContentAccess(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | | WebViewContentAccess.java:38:9:38:55 | setAllowContentAccess(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | +| WebViewContentAccess.java:41:25:41:49 | (...)... | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | | WebViewContentAccess.java:43:9:43:44 | setAllowContentAccess(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | +| WebViewContentAccess.java:46:25:46:41 | new WebView(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | | WebViewContentAccess.java:48:9:48:44 | setAllowContentAccess(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | +| WebViewContentAccess.java:51:25:51:44 | getAWebView(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | | WebViewContentAccess.java:53:9:53:44 | setAllowContentAccess(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | +| WebViewContentAccess.java:55:29:55:48 | getAWebView(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | +| WebViewContentAccess.java:57:25:57:44 | getAWebView(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccess.qlref b/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccess.qlref index f907dcc5755..8ea25a487de 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccess.qlref +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccess.qlref @@ -1 +1 @@ -Security/CWE/CWE-200/AndroidWebViewSettingsContentAccess.ql +Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.ql \ No newline at end of file diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccessDataFlow.expected b/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccessDataFlow.expected deleted file mode 100644 index 6b0c6c52625..00000000000 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccessDataFlow.expected +++ /dev/null @@ -1,5 +0,0 @@ -| WebViewContentAccess.java:41:25:41:49 | (...)... | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | -| WebViewContentAccess.java:46:25:46:41 | new WebView(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | -| WebViewContentAccess.java:51:25:51:44 | getAWebView(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | -| WebViewContentAccess.java:55:29:55:48 | getAWebView(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | -| WebViewContentAccess.java:57:25:57:44 | getAWebView(...) | Sensitive information may be exposed via a malicious link due to access of content:// links being permitted. | diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccessDataFlow.qlref b/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccessDataFlow.qlref deleted file mode 100644 index 8ea25a487de..00000000000 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/WebViewContentAccessDataFlow.qlref +++ /dev/null @@ -1 +0,0 @@ -Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.ql \ No newline at end of file